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In Brief 
RANDEX WORM AUTHOR 
ARRESTED 


A 16 year-old juvenile from 
Canada has been charged with 
writing and spreading the Randex 
worm. The worm, which allows 
remote intruders to access and 
control computers, is believed to 
have developed more than 20 
variants since its release last 
November. The Royal Canadian 
Mounted Police announced the 
arrest of the youth, who is too 
young to be named, on 28 May 
2004, although charges were filed 
before then. 


TAIWANESE TROJAN AUTHOR 
TRAPPED 


Taiwanese police have arrested 
the author of the Trojan horse 
known as 'Peep', after it was used 
by Chinese hackers to steal 
Taiwanese government informa- 
tion. The 30 year-old program- 
mer, Wang An-ping, was believed 
to have put the Trojan on hacking 
websites to advertise his skills; 
instead the program was used to 
retrieve and destroy information 
from infected PCs in schools, 
companies and government agen- 
cies. He denies any knowledge of 
the attacks, but admits that he 
wrote the software and was asso- 
ciating with Chinese software 
developers. If found guilty, he 
could get up to five years in 


prison. 


The 
_ Defense released a special panel © 
/ report, which showed that dat- 
data mining. “TAPAC is aware 


- becoming 


_ report 


Pentagon panel checks privacy in war 


on terrorism 
Wayne Madsen 


amining is at risk of invading 
the privacy rights of US 


: citizens. 


The titled 


report, 


Fight Against Terrorism," and 
_ prepared by the Technology and — 
Privacy Advisory Committee — 
(TAPAC) said that although ties, including:” 
_ data mining could be a useful © 
_ tool in the fight against terror- 
_ ism, its unfettered use without | 
controls or an adequate predi- 
cate, could "run the risk of | 


the 


_ equivalent of general searches, 
_ which the authors of the Bill of | 
Rights were so concerned to 
_ protect against." 
The TAPAC report was sent 
to Defense Secretary Donald | 
_ Rumsfeld with a number of rec- 
ommendations on improving — 
privacy with relation to intelli- 
_ gence gathering systems on— 
_ potential terrorist threats. © The 
_ TAPAC, in its report, stated 
_ that there were a number of sys- 
tems in operation or under | 
development that encouraged — 
data mining of the personal — 
information of Americans: The | 
the | 


Total Information Awareness — 


said that 
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COMPUTER 


US Department of | 


21st-century | 


program (TIA), which has had — 
its funding source blocked, was © 
not unique in its potential for 


_ of many other programs in use | 
or under development both | 
within DOD and elsewhere in 
"Safeguarding Privacy in the the government that make sim- 
ilar uses of personal information | 
concerning US persons to_ 


detect and deter terrorist activi- | 


¢ DOD programs to determine | 
whether data mining can be | 
used to identify individuals — 


who pose a threat to US 
known as the Threat Alerts and 


forces abroad. 


_ ¢ The intelligence community's © 


Advanced Research 


Development Activity center, 
based in the National Security _ 
Agency, to conduct ‘advanced _ 
research and development 
related to extracting intelli- 


gence from 


transmitted or manipulated © 


by electronic means.’ 


Passenger 


System in the Department of © 


Homeland Security (‘DHS') 


e The Treasury Departments 


Financial 
Enforcement Network 


¢ Federally mandated ‘Know | 


Your Customer’ rules 


and | 


information | 


Computer-Assisted 
Prescreening © 


Crimes 


e The 'MATRIX' (Multistate 
Anti-Terrorism Information 
Exchange) system to link law 
enforcement records with 
other government and pri- 
vate-sector databases in eight 
states and DHS 

* Congress mandate in the 
Homeland Security Act that 
DHS 'establish and utilize . . . 
a secure communications and 
information technology infra- 
structure, including data min- 
ing and other advanced ana- 
lytical tools,’ to ‘access, 

receive, and analyze data 

detect and identify threats of 
terrorism against the United 


States. 


Also, the TAPAC reported 
that one Pentagon project, 


Locally Observed Notices 
("TALON"), allows military 
installations to share informa- 
tion about threats, suspicious 
activity, or other anomalous 
behaviour via a Web-based sys- 
tem. Information about suspi- 
cious people who are either 
denied access to, or who are 


_ observed behaving suspiciously 


around, a military installation 
can be instantly shared with 
other military bases and fused 


» with other information main- 


tained on targeted suspicious 
individuals. 

TAPAC's report contained a 
of proposals 
Rumsfeld, including that he 
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FRAUD & SECURITY 


a - 


establish a regulatory frame-_ 
work applicable to all data min- | 
ing conducted by the Pentagon 
that involves personally identi-_ 
fiable information concerning © 
US persons. Another recom- | 
mendation is to create a policy- | 
level privacy officer to check if | 
the regulations are carried out. - 
The creation of two panels of | 
external privacy experts to. 
advise the Pentagon and the | 
President on privacy issues is | 
also recommended. The need | 
for oversight, training, ethics, | 


privacy." 


sensitivity to privacy concerns, 


and inter-agency dialogue, are — 


also called for in the report. 


Rumsfeld appointed 


information technologies to 
identify terrorists before they | 


" 


act. 


Rumsfeld also 


gies within the 


Department is carried out in | 
accordance with US law and | 


American values 


Cyber attacks on banks double 


from 2003 


Brian McKenna 


Online security attacks on the | 
global financial sector have | 


doubled in the last 


Deloitte and Touche's second 
annual Global Security Survey 
indicates a dramatic increase in © 
the respondents reporting sys- | 
tem breaches among financial 


institutions. 


The survey, released on 27 | 
May, showed that the number 
of financial institutions whose _ 
systems have been compro- | 
mised in the last year has | 
increased by 39% to 83%. 
Moreover, 40% of victims said | 
they had sustained financial - 


loss. 


The survey sampled 100 
companies, including 31 of the | 
world's top 100 financial serv-_ 
ices firms, 23 of the top 100. 
banks, and 10 of the top 50. 
the loss due to the increased — 


insurance companies. 


A senior banking source at a_ 
City of London institution | 
confirmed that cyber attacks | 


and financial losses 


increased in the last year. | 
"There can be no doubt of | 
that", he said, "though it is | 


year. © 


have 


hard to get an overall picture. © 
Some colleagues at other insti-_ 
tutions are saying it is 'business _ 
as usual’ while others do report 


significant financial losses." 


Eighty-seven per cent of the © 
professional services firm's | 
respondents said they had fully 
_ deployed anti-virus measures, — 
which is down from 96% in 
2003. While this might indi-— 
cate a loss of faith in tradition- 
al AV technology, caused by | 
the success of network worms | 
such as Blaster and Sasser, the | 
City of London banking 
source expressed scepticism. 
"It's more that anti-virus is 
lacking at the customer end, © 
especially regarding phishing © 


attacks”. 


Deloitte and Touche failed 
to put anumber on the scale of | 


volume of attacks. 


The banking source said that © 
"losses are starting to get ona 
par with credit card fraud loss- _ 
es, but at present it is more 
about brand damage and 


internal disruption". 


the | 
TAPAC in February 2003 to | 
examine the use of "advanced | 


charged — 
TAPAC "to ensure that the — 
application of such technolo- | 
Defense | 


related to | 
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PROOF-OF-CONCEPT VIRUS 
THREATENS 64-BIT SYSTEMS 


Symantec has released details of 
what is thought to be the first 
threat to 64-bit Windows systems. 
The virus is a "proof-of-concept" 
program — to demonstrate that a 
certain vulnerability exists — 
rather than an active and malicious 
virus. Named W64.Rugrat.3344, 
it is not believed to be a significant 
threat due to the relatively small 
number of 64-bits systems in use, 
however more viruses are anticipat- 
ed as the systems increase in popu- 
larity. The program does not work 
FOR STUDENT HACKER 


on 32-bit windows platforms. 


WORMS COST ISPS 123 
MILLION 


ly from worms this year - to the 44 download the game, while he 


tune of 123 million Euros. The | : : 
; used their bank account details for 
increased traffic from worms can | : 

; _ online shopping. The program, 
cause an upsurge in support calls to | 


ISPs. The associated costs with | Perfect Keylogger, would install 


dealing with worms, including — itself and record all strokes when- 
, : 

increased customer support, loss of | 

brand equity and tactical response | 

teams can lead to a financial prob- | 


lem that may exist long after the | 


worm has gone. 


ZOMBIES DRIVE COMCAST 
SPAM RECORD 


Zombie computers have added — 
700 million e-mails a day to the | 
100 million legitimate messages _ 
flowing through Comcast. This has 
made the US high speed cable- — 
based internet service provider the | 
world's biggest single source of | 
spam. Zombie computers arise — 
when spammers use bugs in 
Microsoft Windows to take over _ 
PCs and use them to send junk e- © 
mails, mostly via port 25. PCs with 
broadband, always-on connections — 
are so quick that most users do not — 
spot what should be a degraded | 


service. Comcast has over 21 mil- 


lion users. 


A student at the 


_ FBI INVESTIGATE CISCO CODE 
: THEFT 


The FBI is working with Cisco, as 
it appears that some of its source 
code has been stolen. A small 
amount of the source code, which 
could be used by hackers to sabo- 
tage operating systems, was posted 
on a Russian website. Few further 
details are available as the FBI and 
Cisco continue to investigate the 
theft and the possible hacking of 


their corporate network. 


"GAME' RECORDS KEYSTROKES 


National 


University of Singapore was recent- 
_ ly jailed for hiding a keystroke log- 


ging program as a game on his 
European ISPs will suffer financial- _ 


website. Fellow students proceeded 


ever someone downloaded the 
game from Nguyen Van Phi 
Hung's website. He used funds 
stolen from bank accounts to pur- 


chase phone cards and magazine 
subscriptions. The computer engi- 
neering student pleaded guilty to 
several charges and could serve a 
maximum penalty of 10 years. 


HACKERS DEFACE MICROSOFT 
WEBSITE 


Hackers calling themselves the 
"Outlaw Group" sabotaged the 
UK press area of Microsoft's web- 
site on 24 May 2004. Microsoft 
say that this did not compromise 
confidential data. 
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